Splunk SOAR Certified Automation Developer

Here you have the best Splunk SPLK-2003 practice exam questions

You have 78 total questions to study from
Each page has 5 questions, making a total of 16 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on January 3, 2026
This site is not affiliated with or endorsed by Splunk.

Question 1 of 78

Which of the following can the format block be used for?

To generate string parameters for automated action blocks.

To create text strings that merge static text with dynamic values for input or output.

To generate arrays for input into other functions.

To generate HTML or CSS content for output in email messages, user prompts, or comments.

Correct Answer: B

Question 2 of 78

During a second test of a playbook, a user receives an error that states: "an empty parameters list was passed to phantom.act()." What does this indicate?

The container has artifacts not parameters.

The playbook is using an incorrect container.

The playbook debugger's scope is set to all.

The playbook debugger's scope is set to new.

Correct Answer: A

Question 3 of 78

Which of the following can be edited or deleted in the Investigation page?

Action results

Comments

Artifact values

Approval records

Correct Answer: A

The correct answer is that action results can be edited or deleted on the Investigation page. This typically includes the ability to modify or remove the outcomes of certain actions taken during the investigation process. Comments, artifact values, and approval records generally have more restrictive editing permissions to maintain the integrity of the investigation.

Question 4 of 78

What is the main purpose of using a customized workbook?

Workbooks automatically implement a customized processing of events using Python code.

Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.

Workbooks guide user activity and coordination during event analysis and case operations.

Workbooks may not be customized; only default workbooks are permitted within SOAR.

Correct Answer: C

Question 5 of 78

Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)

SplunkWeb (8472), SplunkD (8589), HTTP Collector (8962)

SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)

Correct Answer: C